An engineer has integrated a new DMVPN to link remote offices across the internet using Cisco IOS routers. When connecting to remote sites, pings and voice data appear to flow properly, and all…

DMVPN adds GRE and IPsec encapsulation headers to each packet, reducing the effective payload MTU below the standard 1500-byte Ethernet MTU. RDP sessions transmit large data packets that exceed this reduced MTU and are dropped when path MTU discovery fails, while small ICMP pings and low-bitrate voice packets remain within the limit. Adjusting the MTU on tunnel interfaces and clamping the TCP MSS resolves the fragmentation issue.

If an extended ACL were blocking TCP port 3389, RDP connections would be consistently refused at the packet level - not allowed for pings - indicating ACL filtering is not the cause.

An RDP server certificate problem would cause a TLS or authentication negotiation error within the established TCP session, not a layer-3 connectivity failure affecting all traffic of a certain size.

DMVPN timeout values control how long idle spoke-to-spoke tunnels are maintained before teardown, and have no effect on whether packets of a given size can be successfully forwarded through the tunnel.